Hackers Stole Instagram Accounts Simply by Asking Meta AI to Give Them Access
Hackers have been stealing Instagram accounts by asking Meta's AI support bot to link a target account to a new email address, without any verification needed. The AI sends a code to the attacker's email, which is then used to reset the password and gain full access. One victim only recovered his account after sending Meta's AI a link to a news article about the vulnerability.
Background
- The article reports that hackers stole Instagram accounts by simply asking Meta's AI-powered support chatbot to link a new email address to a target account, bypassing normal authentication. The AI bot sent a reset code to the attacker, granting full access. This was widely shared in security-researcher Telegram groups.<br>- Meta (formerly Facebook) has been aggressively deploying generative AI across its products under Mark Zuckerberg's leadership, including customer support chatbots that replace human agents. Critics argue this rollout prioritizes AI adoption over security and reliability.<br>- The author, John Gruber (Daring Fireball), recounts a friend with a rare three-letter Instagram username losing his account this way and only recovering it after sending the AI a link to the 404 Media article exposing the flaw — suggesting the AI itself then acknowledged the issue.<br>- 404 Media is an independent tech-journalism outlet that frequently covers cybersecurity, platform abuse, and the unintended consequences of AI systems. Their original reporting broke the story of this vulnerability.